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Abstract 


The purpose of this study is to present risk identification tools in Polish micro, small and medium-sized 
enterprises (MSMEs). Risk identification is a key element of the risk management process in compa- 
nies. Correctly fitting risk identification tools affect the accuracy of management decisions. The result 
of research is to identify the leading risk identification tools used by MSMEs. The study was conducted 
in 2010-2012 using a mixed survey-monographic method and questionnaires. The qualitative data were 
obtained during the study. 
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Introduction 


Exploring the decision-making mechanisms of micro, small and medium enterprises 
(MSMEs) is one of the key areas of economic research. MSMEs, which constitute over 90% of 
enterprises in all countries, are an important source of manufacturing and employment. They 
employ 33% of workers in low-income countries and 62% of workers in high-income countries 
(Vandenberg, 2009, p. 8). In Poland, the importance of this sector is even greater. MSMEs con- 
stitute over 99 percent of the total number of entities (94 percent of them are micro entities) and 
participate in the creation of more than 46 percent of gross domestic product. The largest share 
of this group is micro entities, which in 2008 formed 29.8 percent of GDP (GUS, 2011, p. 36; 
PARP, 2010.). At the same time they belong to a group of companies particularly sensitive to 
changes in the market environment. Therefore, research on risk awareness and behavior in this 
area among the group appear to be particularly reasonable. 

The presented research continues the author’s discussion on risk management in the 
Polish MSMEs publicized in “Risk Management in Polish Companies” (Gorzen-Mitka, 2012). 
Therefore, the paper includes: 

1. Literature review on risk management and risk identification methods and tools; 

2. MSMEs practice indicators in the highlighted elements of the risk management 

process - risk identification. 


Risk Identification Tools - Literature Review 


The issue of risk management in organizations, although extensively discussed on the 
international level (Beasley et al. 2005; Chapman 2007; Economist Intelligence Unit 2010; 
FERMA 2010, Liebenberg et a/. 2003), is an insufficiently discussed and recognized area in 
Poland, particularly in economic practice (Gorzen-Mitka, 2007; Gorzen-Mitka, 2011, p. 322- 
329). World practice shows that risk management has now become an integral part of business 
activities undertaken by the company, builds value to the organization, shaping the effective- 
ness of undertaken actions (Hopkin, 2010; Lam, 2003). 
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It should be noted that the literature clearly indicates that risk management is still in the 
early stages of development. In particular, this applies to MSMEs sector. 

Risk identification is one of the key steps in the risk management process. Its purpose 
is to detect potential events that may affect the realization of its objectives. A risk identifica- 
tion process seeking out the potential source of problems, or with the problem itself, is based 
on a source analysis (risk sources may be internal or external to the system that is the target 
of risk management), problem analysis (risks are related to identified threats), or event basis 
(Spedding, Rose, 2008, p. 69). A clear method of risk identification and evaluation accepted by 
an organization creates the grounds for the manner of risk management (Karkoszka, 2013, p. 
7). Appropriate selection tools at this stage determine the quality of the data received. At the 
same time, identified risks are the basis for analysis in the next stages of the risk management 
process (risk assessment, risk response, etc.). This, in turn, directly influences the correctness 
in decision-making. 

Recommendations for using tools to identify risks are presented comprehensively in the 
ISO 31010 ,,Risk management — Risk assessment technique” standard (ISO, 2009b). Risk iden- 
tification techniques can be often found in the literature as well. The most frequently indicated 
are: brainstorming, Delphi Technique, Influence Diagram, interview (expert judgment), check- 
list, Nominal Group Technique, flowcharts, pondering, Root Cause Identification, Cause-and- 
Effect Diagram, questionnaire, SWOT Analysis, synectics, Case Based Approach, Electronic 
Brainstorming, What if? SWIFT structure, HAZOP, Business Impact Analysis (Martines, et al. 
2011, p. 244; Spedding, Rose, 2008, p. 69). 

Recognition of risks and methods’ awareness as well as methods of dealing with it by 
MSMEs are the major subjects of research undertaken by the author. The basis for assessment 
of risk management awareness level in the target group of entrepreneurs in this publication are 
indications of the respondents regarding the identification of key risks in the organization. 


Methodology of Research 


Study on risk management in micro and small enterprises was carried out in the first half 
of 2010 (survey J), in the first half of 2011 (survey I) and in the first half of 2012 (survey IT) 
among the same group of entities operating in the sub-Silesian region of Czestochowa. Due 
to the low awareness of risk management proven in previous author’s studies, decisions were 
taken to use purpose-random selection of entities engaging in an area of interest. The statistical 
material for the study was gathered through partial studies carried out by a purpose-random 
selection of statistical collective of SME sector from Czestochowa subregion. Due to the non- 
random sampling and sample size, the results and conclusions apply only to the companies in 
the study. Although the small number of responses indicates that the sample is not representa- 
tive, some general conclusions can be drawn, since the purpose was to conduct exploratory 
research. Low response level was expected due to the nature of the research and constantly low 
interest in the topic of risk management. 

The study was conducted using a mixed survey-monographic method. The main research 
technique was a questionnaire. The questionnaire included 30 questions. The questions were 
closed, however respondents could suggest their own answer, deviating from the proposed 
ones, in the “other, please specify” option. 483 entities were selected for a study. 54 of them ex- 
pressed consent to participate in survey I, in survey II — 47 and in survey III - 106. The analysis 
included 49 surveys in study I, in study II - 40 surveys and in study III - 103 (questionnaires 
sent by other entities were filled in incorrectly or incompletely). The structure of respondents 
presented Table 1. 
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Table 1. Structure of respondents of studies (in %). 








Specification Study | Study Il Study Ill 
N=49 N=40 N=103 
Micro-entities 41 15 76 
Small businesses 19 10 18 
Medium-sized enterprises 33 15 6 





Source: own study 


In both studies, a leading group of respondents were micro-entities. Surveyed entities car- 
ried out their activities in various areas: production, trade and services. The involvement of pro- 
duction often involves activities in the area of trade. The companies participating in the study were 
mainly manufacturers offering their final products. This is undoubtedly related to the specificity of 
the Silesian industrial area. The frequency analysis method was used for data interpretation. 


Results of Research (Risk Identification Tools in MSMES Practices) 


Organizations, taking part in the research, indicated that they were considering the con- 
sequences that may result in the risks they were identifying — 59% (survey I) (70% micro and 
56% of small businesses), 28% (survey IT) (30% micro and 20% of small businesses) and 34% 
(survey ITT) (43% micro and 23% of small businesses). However, only 24% organizations (sur- 
vey I), 18% (survey IT) and 21% (survey III) were considering the causes (sources) of the risks. 
The consequence of the key risk ranking — where a significant group of identified risks are the 
internal risks, depending on how the organizations function— seems to be worrisome. 

Such inconsistencies were observed during the research to identify the extent of the 
risks relevant to the organization. The respondents, in two separate questions, had to indicate 
whether comprehensive and systematic identification of risks is conducted in all areas of their 
business and whether their company keeps a register of risks. 

With regards to the first question, 49% MSMEs (survey I) and in this 50% micro and 
44% small entities (with respectively 20% and 11% answered “no opinion”) emphasized that 
their companies conducted a systematic and comprehensive review of risks. 

On the other hand, in answer to the second question, 82% MSMEs (85% micro and 89% 
of small entities) admitted that they did not keep the register of risks occurring. 

In study II, 33% of MSMEs reported they were making a comprehensive and systematic 
identification of risks . At the same time, 90% claimed that they do not keep any register of 
risks. 

In study ITI, the entities showed a greater knowledge of the issues of risk identification. 
87% subjects did not have a systematic identification of threats and 93% did not keep a register 
of risks. The responses to these two questions in study I and II indicated significant differences 
(which proved a misunderstanding of the nature of the risk identification), where as in study III 
responses were significantly correlated. The conclusion is: the awareness of risk identification 
tools are systematically growing. 

The data indicates a low level of basic knowledge on the construction of the risk man- 
agement process in the organization. The reason for this is that - among other things - in the 
latest risk management standard, ISO 31000:2009 (ISO 2009a), risk register is a key element of 
building an effective risk management system in an organization. Counterweight to the above, 
however, may be a claim that 65% (survey I), 70% (survey II) and 73% (survey IIT) of compa- 
nies declared that their actions in the identification of risks are considered to be effective. 

The study showed the intuitiveness of activities related to key areas of uncertainty in the 
organization. The basic tools used to identify risks were the previous experience of manage- 
ment, brainstorming and SWOT analysis.The respondents were presented 10 tools used in the 
field of European business practices. 
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Table 2. Risk identification tools and techniques (% of responses, max. 3 an- 






































swers). 
MSMEs 
Specification E 
pecificati 2010 2011 2012 Average 2010-2012 
(Ranking) 
Previous experience 78 68 83 76 (1) 
Documents review 43 50 52 48 (2) 
Brainstorming 39 28 51 39 (3) 
Opinions of experts (Delphi Technique) 31 20 33 28 (4) 
Process analysis 31 20 19 23 (5) 
Surveys / Polls 10 18 11 13 (8) 
SWOT analysis 37 13 12 21 (6) 
Interview / Discussion 12 10 10 11 (9) 
Focus groups 29 5 8 14 (7) 
Simple modeling 6 0 7 4 (10) 





Source: own study 


Most of the surveyed companies identified several tools used in this area, however, as 
presented in Table 2, the experience and intuition are the primary way to identify risks. Most 
often MSMEs rely on their own experience in identifying risks. This result may be caused by 
lack of knowledge and skills in the use of other tools, beliefs in their low efficiency or convic- 
tion of the high cost of their application. 

For example, the study “Risk identification techniques knowledge and application in the 
Brazilian construction” (Martines et al., 2011) shows that the main tools for identifying risks 
are checklist, flowchart and brainstorming. 


Discussion 


Consideration of risk in decision-making is now becoming an important element influ- 
encing the effectiveness of the organization (Bernstein, 1996). The survey showed that the risk 
identification techniques are previous experience, documentation review and brainstorming. 
This result is significantly different from the list of identification techniques described in the 
literature. For example, the study “European Risk Management FERMA Benchmarking Survey 
2010” shows that the main tools for risk identification and measurement are workshops, inter- 
nal and external risk records, scenario analysis, Value at Risk and stochastic models (FERMA 
2010, p. 27). Brainstorming, one of the most frequently indicated risk identification techniques, 
has been identified only as a third. In addition, it is clear that among the participants there is 
no overall knowledge of the techniques described in literature that might be applied to identify 
risks. This situation certainly influences the application of these techniques. 

Growing awareness of the role of risk in business activities, however, leads to searching 
new knowledge about risk identification tools, especially among the companies forming the 
core of any economy (MSMEs). Although the findings presented in the study cannot be gener- 
alized to the entire population, they seem to indicate a significant area for both theoretical and 
empirical research. This leads to further in-depth qualitative research in this field. It should be 
noted that the data contained in this paper is part of a larger study, and shows only the key issues 
of risk management in the Polish MSME sector. 
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Conclusion 


The business management literature has largely neglected the subject of risk manage- 
ment for SMEs. Therefore, the aim of this research was to explore the current state of risk 
management and to reveal the problems with implementing a risk management system in Polish 
MSMEs. The number of enterprises with established risk identification tools (or at least plan- 
ning to establish it) is remarkably small. This suggests that MSMEs have a problem with this 
issue. It may be the result of a poor knowledge about it, usefulness or possibilities of use. 
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